Microsoft Disrupts EvilTokens AI-Powered Phishing Service, Two Arrested in UK

Microsoft’s Digital Crimes Unit, authorized by the U.S. District Court for the Eastern District of Virginia, took down the EvilTokens device-code phishing service. Microsoft says the platform used AI “at every step of the attack chain” and was tied to more than 12,000 compromised inboxes.

The action involved Health-ISAC, Cloudflare, Coinbase, OpenAI, and other partners. Two people were arrested in the UK in connection with the takedown. EvilTokens was sold on Telegram for a $1,500 initiation fee plus a $500 monthly subscription.